Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c9be63819d31319…

MALICIOUS

PDF

48.0 KB Created: 2020-12-18 21:35:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0b0cca31f244e2c7b96c0d9ddcf63a3e SHA-1: abe70507ca55546a8c8500eab5c9cf455ef10260 SHA-256: 3c9be63819d31319df08c389bcd3ec912e6b0be7dfc851f788ebfdd679031504
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL 'https://traffmen.ru/strik?utm_term=proving+lines+are+parallel+worksheet' is flagged as malicious. While no scripts were explicitly extracted, the PDF structure and the malicious link suggest an attempt to lure the user to a harmful site, consistent with phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7919

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/strik?utm_term=proving+lines+are+parallel+worksheet
    • https://cdn-cms.f-static.net/uploads/4465024/normal_5fa8d07091797.pdf
    • https://cdn-cms.f-static.net/uploads/4478655/normal_5faf32647d4e1.pdf
    • https://static.s123-cdn-static.com/uploads/4413982/normal_5fcf52d12f13d.pdf
    • https://cdn-cms.f-static.net/uploads/4419827/normal_5fa4568e57b30.pdf
    • https://uploads.strikinglycdn.com/files/5bda749e-532a-425b-9cf9-fbb7ddfb3085/lonagezizoluxawevu.pdf
    • https://s3.amazonaws.com/timafatafej/rarejuzidarej.pdf
    • https://s3.amazonaws.com/nolarifaforuxop/46726156955.pdf
    • https://uploads.strikinglycdn.com/files/26a6c8c5-9a77-4ee8-9f04-641367dab638/where_is_area_code_559_in_texas.pdf
    • https://s3.amazonaws.com/sazixipame/nifutefevesufuleg.pdf
    • https://static1.squarespace.com/static/5fc301a1cd1e280355e1eeb1/t/5fcd16f7d235d37878cbe812/1607276280247/merazinufesexijalebe.pdf
    • https://uploads.strikinglycdn.com/files/4695371c-e4b3-49fd-8ad5-7f74ba332869/fopem.pdf
    • https://uploads.strikinglycdn.com/files/ec7d880c-fd96-451d-b0e5-0e483a5e8689/19529883233.pdf
    • https://s3.amazonaws.com/wazorixekunafob/35463611847.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf68c2f8cdb769c6db2a49/1606379714667/pelp_uc_davis_ship.pdf
    • https://uploads.strikinglycdn.com/files/9942b6bb-fc8b-4b95-a300-e642e2ca6184/budesonide_capsules_cats.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.